CVE-2009-1348
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
- CVSS 2.0
- 7.6 HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
- EPSS
- 2.83% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- mcafee/active virus defense · mcafee/active virusscan · mcafee/email gateway · mcafee/internet security suite · mcafee/securityshield for email servers · mcafee/securityshield for microsoft isa server · mcafee/securityshield for microsoft sharepoint · mcafee/total protection · mcafee/total protection for endpoint · mcafee/virusscan commandline · mcafee/virusscan enterprise · mcafee/virusscan plus · mcafee/virusscan usb
- Source
- cve@mitre.org
References
- http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html
- http://secunia.com/advisories/34949Vendor Advisory
- http://www.securityfocus.com/archive/1/503173/100/0/threaded
- http://www.securityfocus.com/bid/34780
- https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENTPatch, Vendor Advisory
- http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html
- http://secunia.com/advisories/34949Vendor Advisory
- http://www.securityfocus.com/archive/1/503173/100/0/threaded
- http://www.securityfocus.com/bid/34780
- https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENTPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.